Council Blunder Led To Major Release of Personal Details
Data included information on 2,000 children in care
Hammersmith and Fulham has reviewed practices to avoid a recurrence. Picture: blogtrepreneur.com/tech
May 27, 2025
Hammersmith & Fulham Council has been reprimanded after personal details of more than 6,500 people including children were left online for almost two years.
A council officer inadvertently published the data when responding to a Freedom of Information (FoI) request in October 2021.
The local authority’s response included an excel spreadsheet with 35 hidden workbooks, 10 of which contained personal details, which was not discovered until November 2023.
A council spokesperson said the error was fixed as soon as they were notified and staff are no longer allowed to supply information using the same format.
In a finding published by the Information Commissioner’s Office (ICO), the watchdog wrote the council’s response was uploaded to its own online disclosures log and provided to the website What Do They Know? (WDTK), via which the FoI request was made.
WDTK published on its own site in December 2021 but he breach was not identified until WDTK completed a review of its website, following which it informed the council. The information was then taken down from both sites.
According to the ICO, a total of 6,528 people were affected, 2,342 of whom were children.
While the adult data set included council employees, ex-employees and agency staff, the personal information belonging to children was described as ‘sensitive in nature’.
“This data related to the placement of looked after children under the Council’s care. Children’s personal data is considered particularly sensitive and deserving of specific protection,” the ICO reported.
“Of particular concern in this group of children, was the personal data belonging to 96 Unaccompanied Asylum-Seeking Children (UASC).”
The ICO noted a number of remedial steps taken by the council, including that redaction and disclosure guidance has been updated and training completed with the relevant team.
Further recommendations have been proposed by the ICO, such as ensuring the review of the council’s online training is completed.
Sally Anne Poole, ICO Head of investigations, said, “It is imperative all staff are trained regularly and internal guidance and sign off protocols are reviewed on a continual basis to ensure breaches do not happen.
“In publicising this reprimand, we aim to highlight the importance of having the correct policies and procedures in place to mitigate against these types of preventable error.”
A Hammersmith and Fulham Council spokesperson said, “None of the hidden data in the historic FoI response was inappropriately accessed or used. We immediately fixed the error when we were notified. And we no longer allow staff to supply information in this format.”
Ben Lynch - Local Democracy Reporter